New Big Brother Laws Would Reshape Canada's Internet

Three bills would mandate new spyware to scoop your info with no court oversight, and broaden police powers to snoop.

Michael Geist, whose column on digital policy and law runs every Tuesday on The Tyee, holds the Canada Research Chair in Internet and E-commerce Law at the University of Ottawa, Faculty of Law. He can reached at mgeist@uottawa.ca or online at www.michaelgeist.ca.

The push for new Internet surveillance capabilities goes back to 1999, when government officials began crafting proposals to institute new surveillance technologies within Canadian networks along with additional legal powers to access surveillance and subscriber information. The so-called lawful access initiatives stalled in recent years, but earlier this month the government tabled its latest proposal with three bills that received only limited attention despite their potential to fundamentally reshape the Internet in Canada.

The first prong mandates the disclosure of Internet provider customer information without court oversight. Under current privacy laws, providers may voluntarily disclose customer information but are not required to do so. The new system would require the disclosure of customer name, address, phone number, email address, Internet protocol address and a series of device identification numbers.

While some of that information may seem relatively harmless, the ability to link it with other data will often open the door to a detailed profile about an identifiable person. Given its potential sensitivity, the decision to require disclosure without any oversight should raise concerns within the Canadian privacy community.

The second prong requires Internet providers to dramatically re-work their networks to allow for real-time surveillance. The bill sets out detailed capability requirements that will eventually apply to all Canadian Internet providers. These include the power to intercept communications, to isolate the communications to a particular individual and to engage in multiple simultaneous interceptions.

Moreover, the bill establishes a comprehensive regulatory structure for Internet providers that would mandate their assistance with testing their surveillance capabilities and disclosing the names of all employees who may be involved in interceptions (and who may then be subject to RCMP background checks).

The bill also establishes numerous reporting requirements including mandating that all Internet providers disclose their technical surveillance capabilities within six months of the law taking effect. Follow-up reports are also required when providers acquire new technical capabilities.

Serious burden for smaller providers

The requirements could have a significant impact on many smaller and independent Internet providers. Although the bill grants them a three-year implementation delay, the technical capabilities extend far beyond most of their commercial needs. Indeed, after years of concern over the privacy impact associated with deep-packet inspection of Internet traffic (costly technologies that examine Internet communications in real time), these bills appear to require all Internet providers to install such capabilities.

Having obtained customer information without court oversight and with mandated Internet surveillance capabilities, the third prong creates a several new police powers designed to obtain access to the surveillance data. These include new transmission data warrants that would grant real-time access to all the information generated during the creation, transmission or reception of a communication including the type, direction, time, duration, origin, destination or termination of the communication.

Law enforcement could then obtain a preservation order to require providers to preserve subscriber information, including specific communication information, for 90 days. Finally, having obtained and preserved the data, production orders can be used to require the disclosure of specified communications or transmission data.

You'd stay in the dark

While Internet providers would actively work with law enforcement in collecting and disclosing the subscriber information, they could also be prohibited from disclosing the disclosures as court may bar them from informing subscribers that they have been subject to surveillance or information disclosures.

Few would argue that it is important to ensure that law enforcement has the necessary tools to address online crime issues. Yet these proposals come at an enormous financial and privacy cost, with as yet limited evidence that the current legal framework has impeded important police work.

Get The Tyee in your inbox

Your privacy is important to us.

When subscribing to a newsletter edition you'll also get early notice on Tyee events, news, promotions, partner messages and special initiatives.

Further to the provision of the Personal Information Protection Act, personal information is kept confidential by TheTyee.ca and will not be sold, traded, released, shared or distributed to any other individuals, organizations or agencies without prior consent or notification.

Measures have been enacted to ensure the integrity of personal information and to protect it from misuse, loss or alteration. All information submitted to The Tyee is only available to employees or sub-contractors who are bound by agreement with The Tyee to keep the information private. E-mail addresses are only used for the purposes of Tyee-related correspondence or comment moderation.

If you have concerns related to your privacy please contact us at info@thetyee.ca